@mft/moneyhub-api-client 6.99.0 → 6.101.0

package/dist/tokens.js

@@ -72,10 +72,12 @@ This function now requires an object with the following properties:
       "code_verifier" // required for PKCE
   }
 }
+
+For server-side PKCE verifier retrieval, use exchangeCodeForTokensUsingPKCE instead.
 `;
 exports.default = ({ client, config, }) => {
     const { identityServiceUrl, client: { redirect_uri, request_object_signing_alg, keys, client_id }, } = config;
-    const exchangeCodeForTokens = (0, exchange_code_for_token_1.default)({
+    const { exchangeCodeForTokens, exchangeCodeForTokensUsingPKCE, } = (0, exchange_code_for_token_1.default)({
         client,
         redirectUri: redirect_uri,
     });
@@ -102,13 +104,22 @@ exports.default = ({ client, config, }) => {
             const requestObj = filterUndefined({ state, code, id_token, nonce });
             return client.authorizationCallback(redirect_uri, requestObj, verify);
         },
-        exchangeCodeForTokens: ({ paramsFromCallback, localParams }) => {
+        exchangeCodeForTokens: (options) => {
+            const { paramsFromCallback, localParams } = options;
             if (!paramsFromCallback || !localParams) {
                 console.error(exchangeCodeForTokensErrorMessage);
                 throw new Error("Missing parameters");
             }
             return exchangeCodeForTokens({ paramsFromCallback, localParams });
         },
+        exchangeCodeForTokensUsingPKCE: (options) => {
+            const { paramsFromCallback, localParams } = options;
+            if (!paramsFromCallback || !localParams) {
+                console.error(exchangeCodeForTokensErrorMessage);
+                throw new Error("Missing parameters");
+            }
+            return exchangeCodeForTokensUsingPKCE(options);
+        },
         refreshTokens: ({ refreshToken }) => client.refresh(refreshToken),
         getClientCredentialTokens: ({ scope, sub }) => client.grant({
             grant_type: "client_credentials",

package/dist/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,yCAA0B;AAC1B,2CAA4B;AAG5B,+CAAgC;AAChC,wFAAoE;AAEpE,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,CAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAEnE,MAAM,eAAe,GAAG,KAAK,EAAE,EAC7B,GAAG,EACH,GAAG,EACH,QAAQ,EACR,MAAM,EACN,GAAG,EACH,UAAU,EACV,cAAc,GAAG,KAAK,GASrB,EAAE,EAAE,CACL,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;KACjB,kBAAkB,CAAC,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC;KAC9B,UAAU,CAAC,GAAG,CAAC;KACf,WAAW,CAAC,QAAQ,CAAC;KACrB,SAAS,CAAC,MAAM,CAAC;KACjB,MAAM,CAAC,MAAM,EAAE,CAAC;KAChB,WAAW,EAAE;KACb,iBAAiB,CAAC,cAAc,CAAC;KACjC,IAAI,CAAC,UAAU,CAAC,CAAA;AAGrB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAEzC,MAAM,iCAAiC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BzC,CAAA;AAED,kBAAe,CAAC,EACd,MAAM,EACN,MAAM,GAIP,EAAE,EAAE;IACH,MAAM,EACJ,kBAAkB,EAClB,MAAM,EAAE,EAAC,YAAY,EAAE,0BAA0B,EAAE,IAAI,EAAE,SAAS,EAAC,GACpE,GAAG,MAAM,CAAA;IAEV,MAAM,qBAAqB,GAAG,IAAA,iCAA4B,EAAC;QACzD,MAAM;QACN,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAA;IAEF,MAAM,yBAAyB,GAAG,KAAK,EAAE,OAAe,EAAE,EAAE;QAC1D,IAAI,0BAA0B,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAExG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAC,GAAG,EAAC,EAAE,EAAE,CAAC,GAAG,KAAK,0BAA0B,CAAQ,CAAA;QAClF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,0BAA0B,UAAU,CAAC,CAAA;QAE9F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAEnD,OAAO,MAAM,eAAe,CAAC;YAC3B,GAAG,EAAE,0BAA0B;YAC/B,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,OAAO;YACZ,QAAQ,EAAE,GAAG,kBAAkB,OAAO;YACtC,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,cAAc,EAAE,KAAK;SACtB,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,OAAO;QACL,2BAA2B,EAAE,CAAC,EAC5B,KAAK,EACL,IAAI,EACJ,KAAK,EACL,QAAQ,GAMT,EAAqB,EAAE;YACtB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAC,KAAK,EAAE,KAAK,EAAC,CAAC,CAAA;YAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC,CAAA;YAClE,OAAQ,MAAc,CAAC,qBAAqB,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QAChF,CAAC;QAED,qBAAqB,EAAE,CAAC,EAAC,kBAAkB,EAAE,WAAW,EAA8C,EAAE,EAAE;YACxG,IAAI,CAAC,kBAAkB,IAAI,CAAC,WAAW,EAAE;gBACvC,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;gBAChD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;aACtC;YACD,OAAO,qBAAqB,CAAC,EAAC,kBAAkB,EAAE,WAAW,EAAC,CAAC,CAAA;QACjE,CAAC;QAED,aAAa,EAAE,CAAC,EAAC,YAAY,EAAoC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAElG,yBAAyB,EAAE,CAAC,EAAC,KAAK,EAAE,GAAG,EAAgC,EAAE,EAAE,CACzE,MAAM,CAAC,KAAK,CAAC;YACX,UAAU,EAAE,oBAAoB;YAChC,KAAK;YACL,GAAG;SACJ,CAAC;QAEJ,iBAAiB,EAAE,KAAK,EAAE,EAAC,KAAK,EAAE,GAAG,EAA+B,EAAE,EAAE;YAEtE,OAAO,MAAM,CAAC,KAAK,CAAC;gBAClB,UAAU,EAAE,6CAA6C;gBACzD,KAAK;gBACL,SAAS,EAAE,MAAM,yBAAyB,CAAC,GAAG,CAAC;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,yBAAyB;KAC1B,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,yCAA0B;AAC1B,2CAA4B;AAG5B,+CAAgC;AAChC,wFAAoE;AAEpE,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,CAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAEnE,MAAM,eAAe,GAAG,KAAK,EAAE,EAC7B,GAAG,EACH,GAAG,EACH,QAAQ,EACR,MAAM,EACN,GAAG,EACH,UAAU,EACV,cAAc,GAAG,KAAK,GASrB,EAAE,EAAE,CACL,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;KACjB,kBAAkB,CAAC,EAAC,GAAG,EAAE,GAAG,EAAC,CAAC;KAC9B,UAAU,CAAC,GAAG,CAAC;KACf,WAAW,CAAC,QAAQ,CAAC;KACrB,SAAS,CAAC,MAAM,CAAC;KACjB,MAAM,CAAC,MAAM,EAAE,CAAC;KAChB,WAAW,EAAE;KACb,iBAAiB,CAAC,cAAc,CAAC;KACjC,IAAI,CAAC,UAAU,CAAC,CAAA;AAGrB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAEzC,MAAM,iCAAiC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCzC,CAAA;AAED,kBAAe,CAAC,EACd,MAAM,EACN,MAAM,GAIP,EAAE,EAAE;IACH,MAAM,EACJ,kBAAkB,EAClB,MAAM,EAAE,EAAC,YAAY,EAAE,0BAA0B,EAAE,IAAI,EAAE,SAAS,EAAC,GACpE,GAAG,MAAM,CAAA;IAEV,MAAM,EACJ,qBAAqB,EACrB,8BAA8B,GAC/B,GAAG,IAAA,iCAA4B,EAAC;QAC/B,MAAM;QACN,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAA;IAEF,MAAM,yBAAyB,GAAG,KAAK,EAAE,OAAe,EAAE,EAAE;QAC1D,IAAI,0BAA0B,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAExG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAC,GAAG,EAAC,EAAE,EAAE,CAAC,GAAG,KAAK,0BAA0B,CAAQ,CAAA;QAClF,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,0BAA0B,UAAU,CAAC,CAAA;QAE9F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAEnD,OAAO,MAAM,eAAe,CAAC;YAC3B,GAAG,EAAE,0BAA0B;YAC/B,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,OAAO;YACZ,QAAQ,EAAE,GAAG,kBAAkB,OAAO;YACtC,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,cAAc,EAAE,KAAK;SACtB,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,OAAO;QACL,2BAA2B,EAAE,CAAC,EAC5B,KAAK,EACL,IAAI,EACJ,KAAK,EACL,QAAQ,GAMT,EAAqB,EAAE;YACtB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAC,KAAK,EAAE,KAAK,EAAC,CAAC,CAAA;YAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC,CAAA;YAClE,OAAQ,MAAc,CAAC,qBAAqB,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QAChF,CAAC;QAED,qBAAqB,EAAE,CAAC,OAAoD,EAAE,EAAE;YAC9E,MAAM,EAAC,kBAAkB,EAAE,WAAW,EAAC,GAAG,OAAO,CAAA;YACjD,IAAI,CAAC,kBAAkB,IAAI,CAAC,WAAW,EAAE;gBACvC,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;gBAChD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;aACtC;YACD,OAAO,qBAAqB,CAAC,EAAC,kBAAkB,EAAE,WAAW,EAAC,CAAC,CAAA;QACjE,CAAC;QAED,8BAA8B,EAAE,CAAC,OAA6D,EAAE,EAAE;YAChG,MAAM,EAAC,kBAAkB,EAAE,WAAW,EAAC,GAAG,OAAO,CAAA;YACjD,IAAI,CAAC,kBAAkB,IAAI,CAAC,WAAW,EAAE;gBACvC,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;gBAChD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;aACtC;YACD,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAA;QAChD,CAAC;QAED,aAAa,EAAE,CAAC,EAAC,YAAY,EAAoC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAElG,yBAAyB,EAAE,CAAC,EAAC,KAAK,EAAE,GAAG,EAAgC,EAAE,EAAE,CACzE,MAAM,CAAC,KAAK,CAAC;YACX,UAAU,EAAE,oBAAoB;YAChC,KAAK;YACL,GAAG;SACJ,CAAC;QAEJ,iBAAiB,EAAE,KAAK,EAAE,EAAC,KAAK,EAAE,GAAG,EAA+B,EAAE,EAAE;YAEtE,OAAO,MAAM,CAAC,KAAK,CAAC;gBAClB,UAAU,EAAE,6CAA6C;gBACzD,KAAK;gBACL,SAAS,EAAE,MAAM,yBAAyB,CAAC,GAAG,CAAC;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,yBAAyB;KAC1B,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@mft/moneyhub-api-client",
-  "version": "6.99.0",
+  "version": "6.101.0",
   "description": "Node.JS client for the Moneyhub API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "lint": "eslint src/ ",
     "lint-fix": "eslint src/ --fix",
+    "check-secrets": "node scripts/check-secrets.js",
     "test": "mocha --require ts-node/register --config test/opts/integration.json",
     "test-ci": "mocha --require ts-node/register --config test/opts/integration-ci.json",
     "test-caas": "mocha --require ts-node/register --config test/opts/integration-caas.json",
@@ -26,20 +27,20 @@
     "api",
     "openid"
   ],
-  "author": "Moneyub Financial Technology",
+  "author": "Moneyhub Financial Technology",
   "homepage": "https://github.com/moneyhub/moneyhub-api-client",
   "repository": "moneyhub/moneyhub-api-client",
   "license": "ISC",
   "engines": {
-    "node": ">= 12.0.0"
+    "node": ">= 18.0.0"
   },
   "dependencies": {
     "@isaacs/ttlcache": "^2.1.4",
-    "form-data": "^3.0.4",
+    "form-data": "^3.0.5",
     "got": "^11.8.5",
     "jose": "^5.2.3",
     "openid-client": "^5.6.5",
-    "query-string": "^7.1.1",
+    "query-string": "^9.5.1",
     "ramda": "^0.27.2"
   },
   "overrides": {

package/readme.md

@@ -26,6 +26,9 @@ This is an Node.JS client for the [Moneyhub API](https://docs.moneyhubenterprise
 - Get a tax return for a subset of transactions
 - Get the regular transactions on an account
 - Get beneficiaries
+- Create reseller check requests and get consent history
+- Standard financial statements
+- Legacy bank connections listing
 - CAAS (Categorisation as a Service) API for advanced transaction enrichment and categorisation
 
 Currently this library supports `client_secret_basic`, `client_secret_jwt` and `private_key_jwt` authentication.
@@ -64,7 +67,7 @@ const {Moneyhub} = require("@mft/moneyhub-api-client")
 
 ## Publishing (maintainers)
 
-Official releases are published to npm by **GitHub Actions** when a [GitHub Release](https://github.com/moneyhub/moneyhub-api-client/releases) is published (see `.github/workflows/publish.yml`). Do not rely on publishing from a developer machine.
+Official releases are published to npm by **GitHub Actions** when a [GitHub Release](https://github.com/moneyhub/moneyhub-api-client/releases) is published (see `.github/workflows/publish.yml`). The publish workflow runs lint and build on GitHub-hosted runners. Live integration tests are not part of publish; they run in the private synced repository (allowlisted IPs / secrets). Do not rely on publishing from a developer machine.
 
 The `prepublishOnly` lifecycle script runs **`scripts/assert-github-actions-publish.js`** before the build. It exits with an error unless `GITHUB_ACTIONS` is set (as it is in GitHub Actions), so a normal local `npm publish` is blocked. That reduces accidental publishes; it is **not** a security boundary on its own—npm access control and trusted publishing still matter.
 
@@ -74,9 +77,10 @@ To bypass the check in a **documented emergency** only, you can run `npm publish
 
 To use this API client you will need:
 
+- Node.js >= 18.0.0
 - A `client_id`, `client_secret` and `redirect_uri` of a registered API client
 - The url of the Moneyhub identity service for the environment you are connecting to (https://identity.moneyhub.co.uk)
-- The url for the API gateway for the environment that you are connecting to (https://api.moneyhub.co.uk/v2.0)
+- The url for the API gateway for the environment that you are connecting to (https://api.moneyhub.co.uk/v3)
 
 ## To install
 
@@ -257,6 +261,8 @@ The `expirationDateTime` and `transactionFromDateTime` options can be set accord
 
 Set `enableAsync` to true if you wish to make an AIS connection that won't wait for accounts and transactions to be fetched.
 
+Set `accVerification` to true to add the `mh:account_verification` claim. This is independent of `enableAsync`.
+
 **Note:** all methods generate an authorise URL using the Pushed Authorisation Request (PAR) method, see [here](https://docs.moneyhubenterprise.com/docs/pushed-authorisation-requests-par) for more details.
 
 #### `getAuthorizeUrl`
@@ -280,6 +286,20 @@ const url = await moneyhub.getAuthorizeUrl({
   expirationDateTime: "2022-09-01T00:00:00.000Z", // optional
   transactionFromDateTime: "2020-09-01T00:00:00.000Z", // optional,
   enableAsync: false, // optional
+  accVerification: false, // optional - adds mh:account_verification independently of enableAsync
+});
+
+// FAPI 2 / PKCE (server-side storage — never expose code_verifier to the browser)
+const url = await moneyhub.getAuthorizeUrl({
+  scope: "openid bank-id-scope",
+  state: "your-state",
+  nonce: "your-nonce",
+  pkce: {
+    generate: true,
+    storeVerifier: async ({state, codeVerifier}) => {
+      await storeVerifierServerSide(state, codeVerifier); // e.g. Redis keyed by state
+    },
+  },
 });
 
 // Default claims if none are provided
@@ -399,24 +419,6 @@ const defaultClaims = {
 
 #### `getRefreshAuthorizeUrlForCreatedUser`
 
-#### `getAuthorizeUrlLegacy`
-
-This method returns an authorize url for your API client using the legacy method (where a request object is generated and passed in as the `request` query parameter). You can redirect a user to this url, after which they will be redirected back to your `redirect_uri`. It has the same method signature as `getAuthorizeUrl`
-
-```javascript
-const url = await moneyhub.getAuthorizeUrlLegacy({
-  scope: "openid bank-id-scope other-data-scopes",
-  state: " your state value", // optional
-  nonce: "your nonce value", //optional
-  claims: claimsObject, // optional
-  permissions: ["ReadBeneficiariesDetail"], // optional - set of extra permissions to set for auth URL
-  permissionsAction: "replace" // optional - replace default consent permissions. Defaults to "add"
-  expirationDateTime: "2022-09-01T00:00:00.000Z", // optional
-  transactionFromDateTime: "2020-09-01T00:00:00.000Z", // optional,
-  enableAsync: false, // optional
-});
-```
-
 This is a helper function that returns an authorize url for a specific user to refresh an existing connection. This function uses the scope `openid refresh`. (Only relevant for legacy connections)
 
 ```javascript
@@ -444,6 +446,24 @@ const defaultClaims = {
 };
 ```
 
+#### `getAuthorizeUrlLegacy`
+
+This method returns an authorize url for your API client using the legacy method (where a request object is generated and passed in as the `request` query parameter). You can redirect a user to this url, after which they will be redirected back to your `redirect_uri`. It has the same method signature as `getAuthorizeUrl`
+
+```javascript
+const url = await moneyhub.getAuthorizeUrlLegacy({
+  scope: "openid bank-id-scope other-data-scopes",
+  state: " your state value", // optional
+  nonce: "your nonce value", //optional
+  claims: claimsObject, // optional
+  permissions: ["ReadBeneficiariesDetail"], // optional - set of extra permissions to set for auth URL
+  permissionsAction: "replace" // optional - replace default consent permissions. Defaults to "add"
+  expirationDateTime: "2022-09-01T00:00:00.000Z", // optional
+  transactionFromDateTime: "2020-09-01T00:00:00.000Z", // optional,
+  enableAsync: false, // optional
+});
+```
+
 #### `exchangeCodeForTokensLegacy`
 
 This is a legacy method to get tokens for a user.
@@ -469,6 +489,7 @@ This method requires an object with two properties:
 
 - `paramsFromCallback` : an object with all the params received at your redirect uri
 - `localParams` : an object with params that you have in the local session for the user.
+- `pkce` : optional hook to retrieve a stored `code_verifier` server-side (see below)
 
 ```javascript
 const tokens = await moneyhub.exchangeCodeForTokens({
@@ -483,9 +504,18 @@ const tokens = await moneyhub.exchangeCodeForTokens({
     "sub": "the user id", // optional, but without this param, requests where there are missing cookies will fail
     "max_age", // optional, not normally required
     "response_type" // recommended to enhance securirty
-    "code_verifier" // required if PKCE is used
+    "code_verifier" // required if PKCE is used (or use pkce.consumeVerifier)
   }
 })
+
+// FAPI 2 / server-side PKCE — retrieve and delete stored verifier keyed by state
+const tokens = await moneyhub.exchangeCodeForTokens({
+  paramsFromCallback: { code, state },
+  localParams: { state, nonce, sub: userId, response_type: "code" },
+  pkce: {
+    consumeVerifier: async ({ state }) => consumeVerifierServerSide(state),
+  },
+})
 ```
 
 #### `getClientCredentialTokens`
@@ -850,7 +880,7 @@ Similar to getAccounts method, however this method does not return `transactionD
 
 ```javascript
 const queryParams = { limit: 10, offset: 5 , showTransacionData: false, showPerformanceScore: true};
-const accounts = await moneyhub.getAccounts({
+const accounts = await moneyhub.getAccountsList({
   userId: "userId",
   params: queryParams,
 }, options);
@@ -862,7 +892,7 @@ Similar to getAccountsWithDetails method, however this method does not return `t
 
 ```javascript
 const queryParams = { limit: 10, offset: 5 };
-const accounts = await moneyhub.getAccountsWithDetails({
+const accounts = await moneyhub.getAccountsListWithDetails({
   userId: "userId",
   params: queryParams,
 }, options);
@@ -1004,6 +1034,28 @@ const statements = await moneyhub.getAccountStatementsWithDetail({
 }, options);
 ```
 
+#### `getStandardFinancialStatements`
+
+List standard financial statement reports for a user (Money Advice Service schema metadata). Uses the scope `standard_financial_statement:read`.
+
+```javascript
+const statements = await moneyhub.getStandardFinancialStatements({
+  userId: "userId",
+  params: {limit: 10, offset: 0},
+}, options);
+```
+
+#### `getStandardFinancialStatement`
+
+Get a single standard financial statement report by id. Uses the scope `standard_financial_statement:read`.
+
+```javascript
+const statement = await moneyhub.getStandardFinancialStatement({
+  userId: "userId",
+  reportId: "reportId",
+}, options);
+```
+
 #### `createAccount`
 
 Create a manual account for a user. This function uses the scopes `accounts:read accounts:write:all`
@@ -1353,11 +1405,9 @@ const accounts = await moneyhub.getOsipAccounts({
 Get an account for a user. This function uses the scope `osip:read`.
 
 ```javascript
-const queryParams = { limit: 10, offset: 5 };
-const accounts = await moneyhub.getOsipAccounts({
+const account = await moneyhub.getOsipAccount({
   userId: "userId",
   accountId: "accountId",
-  params: queryParams,
 });
 ```
 
@@ -1367,7 +1417,7 @@ Get account holdings for an account. This function uses the scope `osip:read`.
 
 ```javascript
 const queryParams = { limit: 10, offset: 5 };
-const accounts = await moneyhub.getOsipAccounts({
+const holdings = await moneyhub.getOsipAccountHoldings({
   userId: "userId",
   accountId: "accountId",
   params: queryParams,
@@ -1380,7 +1430,7 @@ Get account transactions. This function uses the scope `osip:read`.
 
 ```javascript
 const queryParams = { limit: 10, offset: 5 };
-const accounts = await moneyhub.getOsipAccounts({
+const transactions = await moneyhub.getOsipAccountTransactions({
   userId: "userId",
   accountId: "accountId",
   params: queryParams,
@@ -1728,6 +1778,18 @@ const payees = await moneyhub.getPayees({
 });
 ```
 
+#### `getPayee`
+
+Get a single registered payee by id. This function uses the scope `payee:read`.
+
+```javascript
+const payee = await moneyhub.getPayee({
+  id: "payee-id",
+});
+```
+
+Example script: `node examples/payments/get-payee.js -i payee-id`.
+
 #### `getPayments`
 
 This method returns a list of initiated payments. This function uses the scope `payment:read`
@@ -1995,7 +2057,7 @@ const recurringPayment = await moneyhub.getRecurringPayment({
 This method creates a payment using the recurring payment consent. This function uses the scope `recurring_payment:create`
 
 ```javascript
-const recurringPayments = await moneyhub.getRecurringPayments({
+const recurringPayment = await moneyhub.makeRecurringPayment({
   recurringPaymentId: "Id of the recurring payment consent",
   payment: {
     payeeId: "payee-id", // optional
@@ -2016,6 +2078,22 @@ const revokedRecurringPayment = await moneyhub.revokeRecurringPayment({
 });
 ```
 
+#### `confirmFundsForRecurringPayment`
+
+Confirm that funds are available for a payment under an existing recurring payment consent. This function uses the scope `recurring_payment:funds_confirmation`.
+
+```javascript
+const fundsConfirmation = await moneyhub.confirmFundsForRecurringPayment({
+  recurringPaymentId: "Id of the recurring payment consent",
+  fundsConfirmation: {
+    amount: "10.00",
+    currency: "GBP",
+  },
+});
+```
+
+Example script: `node examples/recurring-payments/confirm-funds.js -i recurring-payment-id -a 10.00`.
+
 #### `getRegularTransactions`
 
 Get all the regular transactions for a user, there is an option to pass an account ID as a parameter as a filter. This function uses the scope `accounts:read`, `transactions:read:all` and `regular_transactions:read`
@@ -2221,6 +2299,20 @@ const resellerCheck = await moneyhub.createResellerCheckRequest({
 }, options);
 ```
 
+#### `getConsentHistory`
+
+Get consent history for the API client, optionally filtered by user. This function uses the scope `consent_history:read`.
+
+```javascript
+const consentHistory = await moneyhub.getConsentHistory({
+  limit: 10, // optional
+  offset: 0, // optional
+  userId: "user-id", // optional
+});
+```
+
+Example script: `node examples/consent-history/get-history.js -u user-id`.
+
 ### CAAS API
 
 The CAAS (Categorisation as a Service) API provides advanced transaction enrichment, categorisation, and management capabilities. All CAAS endpoints use dedicated scopes prefixed with `caas:`.
@@ -2288,7 +2380,7 @@ Example script: `node examples/caas/transactions/get-enhanced-transaction.js -a
 
 #### `caasPatchTransaction`
 
-Update a transaction's user-defined category via the CAAS endpoint. This function uses the scope `caas:transactions:write` and returns the updated transaction data under `data`. The optional `recategorisationType` query parameter (`single` or `future`, defaulting to `single`) controls whether the change applies to this transaction only or to all future matching transactions.
+Update a transaction's user-defined category via the CAAS endpoint. This function uses the scope `caas:transactions:write` and returns the updated transaction data under `data`. Pass `recategorisationType` as a query parameter: `single` (this transaction only), `future` (this transaction and future matches), or `past-and-future` (this transaction, historical matches, and future matches). Defaults to `single` when omitted.
 
 ```javascript
 const result = await moneyhub.caasPatchTransaction({
@@ -2481,6 +2573,14 @@ This method will resolve with a list of all the API connections that a user can
 const availableConnections = await moneyhub.listAPIConnections();
 ```
 
+#### `listLegacyConnections`
+
+This method will resolve with a list of legacy connections from Identity (`.well-known/legacy-connections`).
+
+```javascript
+const availableConnections = await moneyhub.listLegacyConnections();
+```
+
 #### `listTestConnections`
 
 This method will resolve with a list of all the Test connections that a user can connect to.

package/scripts/assert-github-actions-publish.js

@@ -1,10 +1,20 @@
 #!/usr/bin/env node
 // prepublishOnly guard; emergency bypass: npm publish --ignore-scripts
+const allowedRepo = "moneyhub/moneyhub-api-client";
+
 if (process.env.GITHUB_ACTIONS !== "true") {
   console.error(
     "Publishing this package is restricted to GitHub Actions. " +
-      "Create a GitHub Release to trigger the publish workflow. " +
+      "Create a GitHub Release on moneyhub/moneyhub-api-client to trigger the publish workflow. " +
       "For a documented emergency bypass, use npm publish --ignore-scripts."
   );
   process.exit(1);
 }
+
+if (process.env.GITHUB_REPOSITORY !== allowedRepo) {
+  console.error(
+    `Publishing this package is restricted to ${allowedRepo}. ` +
+      `Current repository: ${process.env.GITHUB_REPOSITORY || "(unset)"}.`
+  );
+  process.exit(1);
+}

package/scripts/check-secrets.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+const {execFileSync} = require("child_process")
+
+const git = args => execFileSync("git", args, {encoding: "utf8"})
+
+const blockedPaths = [
+  "examples/config.js",
+]
+
+const secretPatterns = [
+  {
+    name: "PEM private key",
+    regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/,
+  },
+  {
+    name: "JWK private component (\"d\")",
+    regex: /"d"\s*:\s*"[A-Za-z0-9_-]{20,}"/,
+  },
+  {
+    name: "Real client_secret value",
+    regex: /client_secret"?\s*[:=]\s*"(?!your client secret")[^"]{8,}"/,
+  },
+]
+
+const getStagedFiles = () => {
+  const output = git(["diff", "--cached", "--name-only", "--diff-filter=ACM", "--no-renames"])
+  return output.split("\n").map(line => line.trim()).filter(Boolean)
+}
+
+const getStagedContent = file => git(["show", `:${file}`])
+
+const scanFile = file => {
+  const findings = []
+  if (blockedPaths.includes(file)) {
+    findings.push(`${file}: file is blocked from being committed (use examples/config.example.js as a template and keep secrets in the git-ignored examples/config.js)`)
+    return findings
+  }
+  let content
+  try {
+    content = getStagedContent(file)
+  } catch (err) {
+    findings.push(`${file}: unable to read staged content, cannot verify it is secret-free (${err.message})`)
+    return findings
+  }
+  secretPatterns.forEach(({name, regex}) => {
+    if (regex.test(content)) {
+      findings.push(`${file}: matched "${name}"`)
+    }
+  })
+  return findings
+}
+
+const main = () => {
+  const files = getStagedFiles()
+  const findings = files.flatMap(scanFile)
+  if (findings.length === 0) {
+    process.exit(0)
+  }
+  console.error("\nCommit blocked: potential secrets detected in staged changes\n")
+  findings.forEach(finding => console.error(`  - ${finding}`))
+  console.error("\nRemove the secrets, unstage the file, and commit again.")
+  console.error("If this is a false positive, review the staged content before bypassing.\n")
+  process.exit(1)
+}
+
+main()

package/.idea/codeStyles/Project.xml

@@ -1,21 +0,0 @@
-<component name="ProjectCodeStyleConfiguration">
-  <code_scheme name="Project" version="173">
-    <JSCodeStyleSettings version="0">
-      <option name="USE_SEMICOLON_AFTER_STATEMENT" value="false" />
-      <option name="FORCE_SEMICOLON_STYLE" value="true" />
-      <option name="SPACE_BEFORE_FUNCTION_LEFT_PARENTH" value="false" />
-      <option name="FORCE_QUOTE_STYlE" value="true" />
-    </JSCodeStyleSettings>
-    <codeStyleSettings language="JavaScript">
-      <option name="BLOCK_COMMENT_ADD_SPACE" value="true" />
-      <option name="KEEP_BLANK_LINES_IN_CODE" value="3" />
-      <option name="INDENT_CASE_FROM_SWITCH" value="false" />
-      <option name="ALIGN_MULTILINE_PARAMETERS" value="false" />
-      <option name="ALIGN_MULTILINE_FOR" value="false" />
-      <indentOptions>
-        <option name="INDENT_SIZE" value="2" />
-        <option name="CONTINUATION_INDENT_SIZE" value="2" />
-      </indentOptions>
-    </codeStyleSettings>
-  </code_scheme>
-</component>

package/.idea/codeStyles/codeStyleConfig.xml

@@ -1,5 +0,0 @@
-<component name="ProjectCodeStyleConfiguration">
-  <state>
-    <option name="USE_PER_PROJECT_SETTINGS" value="true" />
-  </state>
-</component>